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• A report found criminals who steal identities and file fake tax returns could make $26 
billion in 5 years because the IRS cannot keep up with the fraud. - CNN (See item 17 ) 

• Tree fruit and other crop losses caused by mid- April hailstorms are in the tens of millions 
of dollars and counting for California farmers, according to Kings County agricultural 
officials. - California Farm Bureau Federation (See item 25 ) 

• Authorities arrested 10 alleged members of a white supremacist group training near 
Orlando, Florida. Officials said the group was experimenting with the biological toxin ricin 
and had plotted a disturbance at Orlando City Hall. - Reuters (See item 36 ) 

• Beginning in mid-2011, a widespread series of cyberattacks targeted technology firms, 
transportation and agriculture groups, and government organizations with links to policies 
of interest to China. - Dark Reading (See item ) 

• The mayor of Star, Idaho, declared a state of emergency May 8 in response to two levee 
breaches along the Boise River. - KBOl 2 Boise (See item 60 ) 
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Energy Sector 



Current Electricity Sector Threat Alert Levels: Physical: LOW, Cyber: LOW 

Scale: LOW, GUARDED, ELEVATED, HIGH, SEVERE [Source: ISAC for the Electricity Sector (ES-ISAC) - 
[http://www.esisac.coml 



1. May 9, Beckley Register-Herald - (West Virginia; National) Mine emergency training 
exercises held at MSHA. In simulated mining emergencies, 56 teams from West 
Virginia and other coal mining States gathered May 8 at the National Mine Health and 
Safety Academy in Beaver, West Virginia, to compete in crisis preparedness, including 
firefighting, smoke training and mine rescue. Training exercises were conducted 
concurrently: an outdoor firefighting competition, smoke training in the mine 
simulation laboratory, and a mine rescue contest. The teams demonstrated their 
preparation by assembling the critical breathing apparatus mine rescue workers depend 
on for survival, performing hands-on exercises in fighting fire and handling fire hoses, 
exploring a simulated mine in smoke, and applying first aid to a victim. Meanwhile, the 
Assistant Secretary of Labor for Mine Safety and Health, emergency operations 
personnel, State mining officials, and coal company representatives met to discuss the 
latest improvements in mine emergency training and mine rescue technology. 

Source: http://www.register-herald.com/local/xl856220713/Mine-emergency-training- 
exercises-held-at-MSHA 



2. May 9, Associated Press - (Wyoming) 3 critically injured in Wyoming refinery 
fire. Three workers injured in a fire at the Sinclair refinery near Rawlins, Wyoming, 
were taken to a bum center in Colorado in critical condition. Sinclair Oil Corp. said the 
flash fire happened May 8 inside a gas recovery unit at its refinery, about 5 miles east 
of Rawlins. The federal Occupational Safety and Health Administration sent two 
investigators to the facility to look into the incident. Sinclair said there appeared to be 
little or no damage to the facility. 

Source: http://www.cbsnews.com/8301-501363 162-57430732/3-critically-iniured-in- 
wyoming-refinery-fire/ 

3. May 9, Bloomberg - (California) California to propose new fracking rules, review 
agency oversight of injection wells. California oil and gas regulators plan to propose 
new regulations for hydraulic fracturing activities and re-examine existing rules for 
underground injection wells, Bloomberg reported May 9. The Department of 
Conservation’s Division of Oil, Gas, and Geothermal Resources (DOGGR) released a 
“road map” May 3 outlining its plan to revisit the State’s oversight of underground 
injection wells to better protect drinking water supplies and workers. As part of the 
process, the division said it would look at the use of carbon dioxide as an enhanced oil 
recovery tool, the storing of carbon dioxide in injection wells, and the reinjection of 
waste gas. DOGGR said it will hold a series of public workshops to gather input for 
new fracking rules, which it plans to propose by the end of the summer. Also, DOGGR 
said it will commission an independent study of the impact of fracking in California. 
Existing regulations protect well casings, hydrocarbon-bearing geologic formation, and 
groundwater, DOGGR said. Through the workshops, the agency said it will try to 
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identify steps needed to ensure well integrity, proper testing procedures, ways to 
protect resources, and suitable reporting requirements. 

Source: http://www.bna.com/california-propose-new-nl2884909259/ 

4. May 8, San Jose Mercury News - (California) Settlement reached in 2009 San 
Francisco Bay oil spill. The owner and operator of the Dubai Star, an oil tanker that 
spilled 422 gallons of thick, black bunker fuel into San Francisco Bay in 2009, will pay 
$1.96 million to settle the case with State and local authorities, the San Jose Mercury 
News reported May 8. Although the spill was relatively small, State officials said it 
harmed the bay, wildlife, and public recreation. The settlement was filed in San 
Francisco County Superior Court. Under the agreement, the owner of the Dubai Star, 
South Harmony Shipping, of Panama, and its operator, Pioneer Ship Management, 
based in Dubai, United Arab Emirates, will pay to settle violations of State clean water 
laws. Most of the money will be used to restore wildlife habitat and enhance public 
recreation in the East Bay, although $550,000 is in civil penalties. The spill occurred 
October 30, 2009, while the Dubai Star’s crew was refueling the ship with bunker fuel 
pumped from a barge owned by Foss Maritime. During the refueling, a tank on the 
ship’s port side filled to capacity and began overflowing, sending 2,000 gallons of 
black fuel onto the deck and 422 gallons into the water. An investigation showed 
nobody noticed the overflow until it was too late, alarms did not sound, and the crew of 
the Dubai Star waited hours before notifying cleanup companies. 

Source: http://www.mercurynews.com/science/ci 205785 1 5/settlement-reached-2009- 
san-francisco-bay-oil-spill 

5. May 7, WECT 6 Wilmington - (North Carolina) Asbestos found during construction 
of new Sutton Plant. Construction on the new natural gas Sutton Energy Complex in 
Wilmington, North Carolina, stopped after asbestos was found on site, WECT 6 
Wilmington reported May 7. The week of April 30, workers were digging in the area 
where the new power plant will be when they uncovered a structure underground that 
was more than 50 years old. Tests on the materials showed traces of asbestos. 
Occupational Safety and Health Administration officials were on site May 4 to assess 
the situation. Officials with Progress Energy decided to stop all construction until the 
issue can be fixed. The move affects roughly 350 workers currently on the project. 
According to a Progress Energy spokesman, no workers have complained of health 
issues related to the exposure to asbestos. There was a team from the state on site May 
7 to determine when the hundreds of workers could go back to work. The existing 
Sutton Power plant is fully operational, and no one at that site is in danger. 

Source: http://www.wect.com/storv/18163622/asbestos-found-during-construction-of- 
new-sutton-plant 

For more stories, see items 8 and 30 
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Chemical Industry Sector 



6. May 8, Lincoln Journal Star - (Nebraska; Missouri; Virginia) Syngenta penalized for 
mislabeling fungicide. Syngenta Crop Protection LLC of Greensboro, North Carolina, 
agreed to pay a $102,000 civil penalty to the United States to settle violations of selling 
or distributing misbranded pesticides through its manufacturing plant in Omaha, 
Nebraska, and through a farm supply retailer, the Lincoln Journal Star reported May 8. 
An administrative consent agreement filed by the Environmental Protection Agency 
(EPA) said inspections of Syngenta’s Omaha facility and a business in Chesapeake, 
Virginia, in March and April 2011 found Syngenta received 16 imported shipments of 
Azoxystrobin Technical, a fungicide, whose bags were not labeled with an accepted 
EPA label. During a separate inspection in August 2011 at Duncan Agri-Service Inc. in 
Savannah, Missouri, the EPA found a bulk tank of Lumax Selective Herbicide, whose 
label was missing a required warning statement. The labeling deficiencies violated the 
Federal Insecticide, Fungicide, and Rodenticide Act, the settlement said. As a result of 
the enforcement action, Syngenta had to relabel all shipments in question. The firm also 
instituted changes in its practices to prevent similar violations, the EPA said. 

Source: http://ioumalstar.com/business/agriculturc/svngcnta-pcnalizcd-for-mislabcling- 
fungicide/article 5 a3fcbdb-e3c 1 -593 8 -ae4 1 -080d 1 c499 1 f 8 .html 

For more stories, see items 4, 21, 22, and 30 



T Return to top ] 

Nuclear Reactors, Materials and Waste Sector 

7. May 9, Nuclear Street - (Ohio) NRC gives Davis-Besse shield building clean bill of 
health. In a report issued May 7, federal regulators formally closed their inspection of 
shield building cracking discovered at the Davis-Besse nuclear plant in Oak Harbor, 
Ohio, during a reactor pressure vessel head replacement in October 2011. The Nuclear 
Regulatory Commission said it was satisfied with FirstEnergy’s plan to deal with the 
cracks, and no violations or adverse findings were identified in the inspection. October 
10, 2011 a contractor noticed subsurface cracks in the concrete while performing 
hydro-cutting to create the hole needed to swap out the RPV head. Following a 
subsequent investigation, FirstEnergy blamed the cracking on a blizzard in 1978, not 
long after the plant began operating, and indicated it would add weather-proofing 
material to the concrete. 

Source: 

http://nuclearstreet.com/nuclear power industry news/b/nuclear power news/archive/ 
2012/05/09/nrc-gives-davis 2d00 besse-shield-building-clean-bill-of-health- 
050902.aspx 

8. May 9, Associated Press - (California) Calif utility says 1,300 tubes in troubled nuke 
plant will be retired, as probe continues. More than 1,300 tubes that carry radioactive 
water inside the San Onofre nuclear plant in San Diego County, California, are so 
damaged that they will be taken out of service, the utility that runs the plant said May 8. 
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The figures released by Southern California Edison are the latest disclosure in a probe 
of equipment problems that have kept the coastal plant sidelined for more than 3 
months. A company statement said that as of May 7,510 tubes were plugged, or retired 
from use, in the Unit 2 reactor, and 807 tubes in its sister, Unit 3. Each of the 
generators has nearly 10,000 tubes, and the number retired is well within the limit 
allowed to continue operation. An Edison executive said the company hopes to restart 
the plant in June, though federal regulators said there was no timetable for a restart. 
Source: http://www.washingtonpost.com/national/calif-utilitv-savs-1300-tubes-in- 
troubled-nuke-plant-will-be-retired-as-probe- 
continues/20 1 2/05/08/gIQAY po9AU story.html 



[ Return to top ] 

Critical Manufacturing Sector 

9. May 9, Fort Lauderdale Sun-Sentinel - (Florida) Explosions, fire damage Delray 
Beach welding shop. An oxygen tank that caught fire in a welding shop May 9 was 
blamed for multiple explosions that damaged the shop and two neighboring units at an 
industrial complex in Delray Beach, Florida. Firefighters said they saw multiple 
explosions that ripped a bay door off the back of the building. They cut through another 
door to get inside the rooms, which were black with smoke and cluttered with 
equipment. It took about an hour for firefighters to get the blaze under control. The 
Skill-metric shop suffered extensive damage and two neighboring units had visible 
smoke damage. 

Source: http://www.sun-sentinel.com/news/palm-beach/delrav-beach/fl-welding-shop- 
fire-delray-20 120509,0,222453 1 .story 

10. May 9, Associated Press - (Virginia) Ford adds Virginia to Windstar minivan 
recall. Ford Motor Co. added 27,000 Windstar minivans from Virginia to a larger 
recall because the rear axles can crack and fail, the Associated Press reported May 9. 
The vans are now part of an August 2010 recall of more than 600,000 Windstars in the 
United States and Canada from the 1998 through 2003 model years. Ford said at the 
time the vans were sold in states where salt is used to clear the roads. Over time, the 
salt can cause the axles to rust, crack, and even break, causing a driver to lose control. 
Virginia was not included in the original recall. However, Ford said a recent analysis 
showed vans there can have similar problems. There were 1 1 reports of axle cracks 
from Virginia between October 2011 and March. 

Source: http://www.sfgate.com/cgi- 

bin/article.cgi?f=/n/a/2012/05/09/financial/f061203D68.DTF 
For another story, see item 53 
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Defense Industrial Base Sector 



11. May 8, Defense News - (National) Fixes for F-35 helmet in the works. The head of 
the F-35 Joint Strike Fighter program touted a fix for the jet’s troubled, high-tech 
helmet, which officials hope will solve jitter picture and lag time issues. A “micro- 
inertial measurement unit” is expected to fix the jitter, while “signal processing changes 
in the software and the architecture” could fix the lag, the F-35 program manager said 
after testifying at a May 8 U.S. Senate hearing. “What I am focused on is seeing the 
demonstration of those fixes working and being effective,” he said. “That will be paced 
out through the remainder of this year and into 2013.” Program officials also plan to 
improve a camera installed on the helmet which they believe will fix “the acuity and 
night vision,” he said. The fixes will be eventually demonstrated through a flight test or 
in a laboratory environment. The program has funding to work on the fixes to the 
primary helmet, made by Vision Systems International, as well as a back-up helmet 
system. 

Source: http://www.defensenews.com/article/20120508/DEFREG02/305080005 



T Return to top i 

Banking and Finance Sector 

12. May 9, Associated Press - (North Carolina) 5 people arrested at Bank of America 
demonstration. Five people were arrested May 9 as they tried to force their way into 
the annual Bank of America shareholders’ meeting in Charlotte, North Carolina, and 
police used a new ordinance to declare the gathering an extraordinary event subject to 
special restrictions. Hundreds gathered on the streets as dozens of police officers 
worked to contain the protest. If a gathering is deemed an extraordinary event, 
authorities can designate areas where people are not allowed to carry backpacks, magic 
markers, and other items. The measures were adopted in advance of the Democratic 
National Convention in Charlotte. 

Source: http://www.wset.com/story/18241952/5-people-arrested-at-bank-of-america- 
demonstration 



13. May 9, Fort Worth Star-Telegram - (Texas) Two Arlington companies indicted. Two 
Arlington, Texas companies accused of being part of a $13 million mortgage fraud 
scheme in north Texas were indicted on criminal charges, the Fort Worth Star- 
Telegram reported May 9. The companies, Sierra Developers and homebuilder Genesis 
Homes of Texas, are accused of generating more than $400,000 from fraudulent loans 
in December 2004. The loans were handled by a lending company run by a mortgage 
broker who has since pleaded guilty to engaging in organized criminal activity and 
money laundering. Seventeen defendants were convicted in the scheme, including two 
who were alleged to be “straw buyers” of homes built by Genesis, the prosecutor said. 
The corporate indictments, handed down quietly in December 2011, accuse Sierra and 
Genesis of providing false payoff information to the lending company for monetary 
gain. Sierra is accused of providing false information on a federal Department of 
Housing and Urban Development settlement statement. Sierra and Genesis homes were 
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the sellers in the transaction, according to officials. 

Source: http://www.star-telegram.com/2012/05/08/3946443/two-arlington-companies- 
indicted.html#storylink=omni popular 

14. May 9, U.S. Securities and Exchange Commission - (Michigan) SEC charges former 
Detroit officials and investment adviser to city pension funds in influence peddling 
scheme. The U.S. Securities and Exchange Commission (SEC) May 9 charged a 
former Detroit mayor, city treasurer, and the investment adviser to the city’s public 
pension funds involved in a secret exchange of gifts to peddle influence over the funds’ 
investment process. The SEC alleged the former mayor and treasurer, who were 
trustees to the pension funds, solicited and received $125,000 in perks paid for by 
MayfieldGentry Realty Advisors LLC, an investment adviser whose chief executive 
officer (CEO) was recommending to the trustees the pension funds invest 
approximately $117 million in a real estate investment trust (REIT) controlled by the 
firm. Neither the officials nor the CEO and his firm informed the boards of trustees 
about the perks and the conflicts of interest they presented. The funds ultimately voted 
to approve the REIT investment, and MayfieldGentry received millions of dollars in 
management fees. According to the SEC’s complaint, members of the mayor’s 
administration began to exert pressure on the CEO in early 2006. The former treasurer 
met with the CEO in February 2006 and the CEO appeared before the boards of 
trustees for the pension funds throughout 2007, recommending the REIT investment. 
Meanwhile, MayfieldGentry began footing the bills for trips taken by city officials that 
extended beyond city business. 

Source: http://www.sec.gov/news/press/2012/2012-88.htm 

15. May 8, Orange County Register - (California) ‘Snowboarder Bandit’ charged in 10 
bank robberies. A Riverside, California man who authorities suspect of being the 
“Snowboarder Bandit” was charged May 8 with 10 bank robberies in which he is 
alleged to have stolen about $30,000. He is facing 10 felony counts of second-degree 
robbery, as well as 2 felony counts of attempted robbery, according to a statement from 
the Orange County district attorney’s office. Authorities have tied him to 10 holdups at 
9 Orange County banks. Authorities also believe he attempted to rob two other banks in 
Irvine, but left without receiving money. 

Source: http://www.ocregister.com/news/bandit-353272-bank-franks.html 

16. May 8, Reuters - (New York; National) Trader in free-riding fraud case admits 
guilt. A Florida man accused of operating a “free-riding” fraud, in which he bought and 
sold $64 million of stock with money he did not have, pleaded guilty May 7 in New 
York to 10 criminal counts. He admitted to grand larceny, securities fraud, and 
scheming to defraud. According to his prepared allocution, the defendant conducted 
“paired trades” more than 200 times at more than 36 brokers using accounts that named 
bogus shell companies and hedge funds. He said this let him buy publicly traded 
securities between July 2009 and September 2010 despite lacking sufficient funds. 
Among the brokerages that he stole from were Barclays Capital, Lazard Capital 
Markets, and Morgan Keegan & Co., according to the prepared allocution. A U.S. 
attorney said the defendant induced brokerages to open accounts by misrepresenting his 
net worth and his alleged control of a $20 million hedge fund. He also said the 
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defendant raised money by falsely telling investors to expect high returns, only to use 
the bulk of the funds to repay earlier investors or on personal expenses. Among the 
companies in which he traded were Baidu Inc, CME Group Inc., Netflix Inc., and 
Priceline.com Inc., according to the SEC. 

Source: http://www.reuters.corn/article/2012/05/08/us-kupersmith-fraud-plea- 
idUSBRE847 1 EH20 1 20508 



17. May 8, CNN - (National) Identity thieves could rake in $26 billion in tax 

refunds. Criminals who file fraudulent tax returns by stealing people’s identities could 
rake in an estimated $26 billion over the next 5 years because the Internal Revenue 
Service (IRS) cannot keep up with the amount of the fraud, the U.S. Department of the 
Treasury Inspector General for Tax Administration (TIGTA) said May 8. “Our analysis 
found that, although the IRS detects and prevents a large number of fraudulent refunds 
based on false income documents, there is much fraud that it does not detect,” the 
inspector general said in prepared testimony before a joint hearing of two House 
subcommittees. The TIGTA report is the first detailed analysis of the tax refund fraud 
problem, which could affect any taxpayer. His projection of $26 billion was larger than 
any other estimate of identity theft tax fraud. In 201 1, according to TIGTA, the IRS 
reported that of the 2.2 million tax returns it found to be fraudulent, about 940,000 
returns totaling $6.5 billion were related to identity theft. In the investigation, the 
inspector general said auditors found another 1.5 million undetected tax returns with 
more than $5.2 billion in fraud. As of April, the IRS reported it had stopped the 
issuance of $1.3 billion in potentially fraudulent tax returns. 

Source: http://www.cnn.com/2012/05/08/us/tax-refund-fraud/index.html?hpt=hp t3 

For another story, see item 54 
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Transportation Sector 

18. May 9, CNN - (Arizona; California) Threats halt 2 Southwest flights. Two Southwest 
Airlines flights from Orange County, California, to Phoenix were the subject of 
security scares May 8, and authorities were investigating whether the incidents were 
linked. Both planes were eventually cleared after officials determined a threat did not 
exist. Southwest Airlines flight 811 was headed to Phoenix’s Sky Harbor International 
Airport from John Wayne Airport when officials removed passengers and brought in a 
bomb squad and canine units to search the plane, said an FBI spokeswoman. “No 
threats of any kind” were found, said an Orange County Sheriff’s Office lieutenant. In 
the second incident, Southwest flight 1184 was taken to an isolated area at Sky Harbor 
after it flew in from John Wayne Airport after authorities received a “non-specific 
threat,” said an airline spokeswoman. Passengers and their bags were re-screened. 
Source: http://www.cnn.com/2012/05/09/us/califomia-planes- 
threats/index.html?hpt=us c2 

19. May 9, Associated Press - (Louisiana; National) Coast Guard steps up inspections of 
towboats. A new round of inspections of towboats and tugs is starting in July as part of 
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a nationwide push by the U.S. Coast Guard (USCG) to improve the safety of the 
nation’s rivers and harbors, the Associated Press reported May 9. Since a 2008 collision 
and oil spill near New Orleans involving an improperly licensed towboat captain, the 
USCG began inspecting work boats across the nation. So far, the USCG said it has 
inspected 2,887 towing vessels that volunteered to be inspected in the 26 States that fall 
under the Guard’s Eighth District, which is headquartered in New Orleans. Starting 
July 1, the agency said it will begin inspecting the rest of the towing fleet in the district. 
“Our goal is 100 percent participation,” said a USCG towing vessel specialist. 

Source: http://abcnews.go.com/US/wireStorv/coast-guard-steps-inspections-towboats- 
1630904 !#.T6pvZlKlWZd 

20. May 9, Associated Press - (Connecticut) Fiery crash shuts down 1-95 north in New 
Haven. Interstate 95 northbound in New Haven, Connecticut, closed after a tractor- 
trailer went off the highway and burst into flames. State police said the driver died in 
the May 9 crash near exit 48, and the medical examiner was called to the scene. 
Authorities said the tractor-trailer went off the highway, rolled down a steep 
embankment, and caught fire. Officials hoped to have the lanes reopened 4 hours later. 
Source: http://www2.witv.com/news/2012/mav/09/fiery-crash-shuts-down-i-95-north- 
in-new-haven-ar-3757344/ 



21. May 8, Ventura County Star - (California) Two unrelated fuel spills lead to closures 
on road near Santa Paula. Six hours after a big-rig crash and fuel spill May 8 led 
authorities to close part of South Mountain Road near Santa Paula, California, 
firefighters responded to an unrelated fertilizer spill about half a mile away, officials 
said. A fertilizer company was transferring liquid fertilizer from a transport to a tank on 
a ranch on South Mountain Road when a pipe leaked, a spokesman for the Ventura 
County Fire Department said. The company estimated about 300 gallons of fertilizer 
spilled. The fertilizer was flowing downhill toward the Santa Clara River but whether 
any got into the waterway was unclear, officials said. Some fertilizer spilled into a 
stream in the area, a battalion chief said. A HAZMAT team from the Ventura City Fire 
Department responded to help clean up the fertilizer spill. 

Source: http://www.vcstar.com/news/2012/may/08/big-rig-overtums-near-santa-paula- 
hazmat-called/ 



22. May 8, Lafayette Advertiser - (Fouisiana) Highway reopened after 1-10 cleanup in 
Acadia Parish. Fouisiana State troopers reopened a stretch of Interstate 10 near 
Jennings after the cleanup from a crash that left the driver of a benzene-laden tanker 
truck severely injured and closed the highway for more than 12 hours May 8. The 
preliminary investigation revealed that an 18- wheeler tanker was traveling east on I- 10 
when it entered the median and overturned. As a result, Interstate 10 was closed near 
mile post 65 to facilitate the safe off-loading of the truck. Fouisiana State Police 
Emergency Services troopers helped assure the safe transfer of the benzene and 
expedite the process in an effort to minimize inconvenience to the motoring public. 
Source: http :l/w w w .theadvertiser.com/article/20 1 20508/NEW SO 1 / 1 205080 1 2/1- 1 0- 
cleanup-extended-into-night-Acadia- 

Parish?odyssey=tab%7Ctopnews%7Ctext%7CFRONTPAGE 
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For more stories, see items 4 , 44 , and 53 



Postal and Shipping Sector 

See item 41 
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Agriculture and Food Sector 

23. May 9, Food Safety News - (Louisiana) Oysters at New Orleans restaurant cause 
norovirus. Fourteen people became ill with norovirus after eating Gulf oysters at a 
New Orleans area restaurant April 28 and 29, the Louisiana Department of Health and 
Hospitals (DHH) announced May 8. As a result, the DHH closed a key harvesting area 
on the Gulf coast east of the Mississippi River and recalled oysters harvested from 
those areas since April 26. The recall includes all shucked, frozen, breaded, post- 
harvest processed oysters, and oysters for the half shell market. Epidemiologists and 
sanitarians from the DHH traced the outbreak to Louisiana oysters from harvest area 23 
consumed at the same restaurant. A Louisiana State health officer and the DHH 
secretary signed the closure order, which took effect at sundown May 8. Area 23 
harvesting area was expected to be closed for at least 21 days. The DHH notified local 
oyster harvesters who work the area, as well as the Louisiana Oyster Task Force. 
Source: http://www.foodsafetynews.com/2012/05/oysters-at-new-orleans-restaurant- 
cause-norovirus/ 



24. May 9, Canadian Press - (International) Ontario crops have suffered millions in 
damage, say growers. The early warm weather in March, followed by sudden flash 
freezes, caused losses to tender fruit and apple growers in a large part of southern 
Ontario, Canada, the Canadian Press reported May 9. An agriculture specialist at the 
University of Guelph said the apple industry alone in Ontario is worth up to $400 
million. An official with the Ontario Tender Fruit Producers Marketing Board in 
Niagara said about 30 percent of peaches and nectarines were affected, with damage 
totaling about $24 million to those 2 crops alone. Growers will not know the impact on 
the grape crop until early June. 

Source: http://www.thestar.com/news/canada/article/1175392— ontario-crops-have- 
suffered-millions-in-damage-say-growers 

25. May 9, California Farm Bureau Federation - (California) Tree fruit harvest to be cut 
as result of April hailstorms. Four weeks after their orchards and fields were pounded 
by intense mid-April hailstorms, San Joaquin Valle, California farmers continued to 
tally losses but said tree fruit and other harvests will be reduced, the California Farm 
Bureau Federation reported May 9. Agricultural commissioners’ in affected counties 
such as Kings and Tulare said crop losses to agriculture were in the tens of millions of 
dollars and counting. The Kings County Agricultural Commissioner requested a U.S. 
Department of Agriculture disaster declaration for damaged crops due to what is being 
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called a “once in 100 years” hailstorm and other storms that occurred April 11-13. To 
qualify for the declaration, farmers must have experienced a 30 percent loss of a 
particular crop, countywide. He reported $20.5 million worth of crop losses in Kings 
County, with the hardest-hit crop, plums, suffering $5.7 million in damage. Losses to 
nectarines were nearly as high, at $5.3 million. Additional crops that took a hit include 
peaches, apricots, and cherries, as well as almonds, cotton, and kiwifruit. Tulare 
County continued to work with farmers to analyze crops damaged in the mid- April 
storms, according to the county’s deputy agricultural commissioner. So far for Tulare, 
impacted crops include stone fruit, nuts, grapes, forage crops, and some citrus. 

Source: http://agalert.com/story/7kU4191 

26. May 8, Food Safety News - (Ohio) Alfalfa sprouts recalled in Ohio due to Listeria 
risk. Cleveland Beansprouts Co. of Cleveland recalled all alfalfa sprouts it produces 
because they may be contaminated with Listeria monocytogenes, Food Safety News 
reported May 8. The contamination was discovered by the Ohio Department of 
Agriculture while collecting and testing samples under the U.S. Department of 
Agriculture’s Microbiological Data Program. The alfalfa sprouts were distributed only 
in Ohio. 

Source: http://www.foodsafetvnews.com/2012/05/alfalfa-sprouts-recalled-due-to- 
listeria-risk-1/ 



27. May 8, U.S. Food and Drug Administration - (National; International) Solid Gold 
Health Products for Pets, Inc. recalls dog food because of possible Salmonella 
health risk. Solid Gold Health Products for Pets, Inc. of El Cajon, California, 
announced a voluntary recall of one batch of WolfCub Large Breed Puppy Food and 
one batch of Solid Gold WolfKing Large Breed Adult Dog, the U.S. Food and Drug 
Administration reported May 8. Solid Gold voluntarily recalled the products that were 
distributed in the United States and Canada. This voluntary recall was being done as 
these products were produced at the facility that was linked to recent recalls of 
Diamond brand pet foods due to potential Salmonella contamination. 

Source: http://www.fda.gov/Safety/Recalls/ucm30337 1 .htm 

28. May 8, U.S. Department of Labor - (Pennsylvania) US Labor Department’s OSHA 
cites Bazzini Holdings for safety and health violations at Allentown, Pa., facility 
after worker’s arm amputated. The U.S. Department of Labor’s Occupational Safety 
and Health Administration (OSHA) cited Bazzini Holdings LLC with 15 workplace 
safety and health violations following an incident in which a worker’s arm was 
amputated at the company’s Allentown, Pennsylvania facility. Bazzini Holdings, which 
employs about 250 workers at the Allentown site, manufactures fine chocolates and nut 
products, the U.S. Department of Labor reported May 8. OSHA’s inspection, initiated 
in November 2011 after the agency was notified of the amputation, found three repeat, 
eight serious, and four other-than-serious violations. The repeat violations involved 
electrical hazards and uncovered projecting shafts. The serious violations included 
additional electrical hazards as well as the company’s failure to: use specific 
procedures for controlling hazardous energy; provide general machine and power 
transmission guarding; develop and implement a hazard communication program; and 
implement a hearing conservation program that includes noise engineering controls, 
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noise monitoring, audiometric testing, and hearing conservation training. The other- 
than-serious violations involved missing electrical covers, unsecured machinery and 
personal protective equipment deficiencies. Proposed penalties total $56,400. 

Source: 

http://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEAS 
ES&p id=22362 

29. May 8, Associated Press - (Pennsylvania; Ohio; New York) W. Pa. fruit farmers: 
major frost damage. Western Pennsylvania fruit farmers said a combination of early 
warm weather and frosts caused major damage. The Erie Times-News reported May 8 
some farmers lost 80 to 90 percent of their fruit crops. The member services director 
for the National Grape Cooperative, which owns Welch’s, told the paper there was 
significant damage to grapes from Ohio to Pennsylvania and New York. He said it may 
be the worst frost damage to grapes in 35 years, though final estimates were not in yet. 
The paper reported some vineyards were undamaged in warmer areas close to Lake 
Erie. 

Source: http://online.wsi.com/article/AP6f777ec5abc24ed5a83620bc7ef215da.html 
For more stories, see items 4 , 6 , and 21 
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Water Sector 



30. May 8, U.S. Environmental Protection Agency - (Washington) Bremerton Gasworks 
added to Superfund national hazardous cleanup list. Bremerton Gasworks, a former 
coal gasification plant that operated in Bremerton, Washington, from 1930 to 1963, will 
be listed on the U.S. Environmental Protection Agency’s (EPA) national list of highly 
contaminated sites, the EPA reported May 8. EPA will manage the site under the 
Superfund cleanup program. “Cleaning up Bremerton Gasworks will help us shut off 
one more source of industrial contamination that threatens Puget Sound,” said the EPA 
Region 10 Superfund Director in Seattle. Sediments in the Port of Washington Narrows 
and soils and groundwater at Bremerton Gasworks are contaminated with polyaromatic 
hydrocarbons from tars associated with the gasification process, plus toxic metals and 
benzene. EPA, the Washington State Department of Ecology, Cascade Natural Gas, and 
the U.S. Coast Guard have been involved in assessments of the site and an earlier beach 
cleanup. Contamination left on the site could still pollute the Washington Narrows and 
Puget Sound. Another concern is that the Suquamish Tribe uses the area as a 
subsistence fishery. 

Source: 

http://yosemite.epa.gOv/opa/admpress.nsf/0/1096A21B78BCD374852579F80075705B 

31. May 8, Milwaukee Journal Sentinel - (Wisconsin) Sewage pumped into river during 
storm. An estimated 16,250 gallons of sewage was pumped into the Kinnickinnic 
River May 6 in a brief sanitary sewer overflow, the Milwaukee Metropolitan Sewerage 
District (MMSD) reported May 8. Wastewater flows in the regional sewer rose high 
enough in an evening rainstorm to trigger a relief pump, the MMSD water quality 
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protection manager said. The pump directed some of the flow to an overflow pipe that 
drains to the river. After 3 minutes, flows in the regional sewer dropped low enough to 
shut off the relief pump. The district was investigating why wastewater levels in the 
sewer spiked for such a short duration in the storm. 

Source: http://www.isonline.com/news/regbrfs09-as5b0gk-150708985.html 

32. May 8, Hawthorne Gazette - (New Jersey) Tests show wells contaminated in North 
Haledon. More than a dozen wells in North Haledon, New Jersey, are contaminated 
with a carcinogenic chemical, but the source of the contamination remains a mystery, 
according to the Passaic County Department of Health May 8. A spokesman for the 
health department said 14 homes on Wayne Court, Wayne, and Passaic Avenues, 
Gemeinhardt Place, and Manchester Avenue tested positive for carbon tetrachloride in 
April, with results averaging between 0 and 34 parts per billion. He said the county 
health department has no records on any reported chemical spill in the area, which is 
predominantly residential. Residents within 1,000 feet of the property were 
subsequently notified and advised to test their well water at their own cost. A 
spokesman for the New Jersey Department of Environmental Protection (NJDEP) said 
homeowners conducted the initial round of testing, and NJDEP is planning to 
determine the extent of the contamination by sampling 30 homes in the adjacent area. 
He said the affected wells were found to contain levels of carbon tetrachloride above 
the 1 part per billion groundwater remediation standard, necessitating action by the 
NJDEP. He noted the agency would handle the cost of any cleanup efforts and 
investigate the source of the water pollution. 

Source: 

http://www.northiersev.com/community/150648625 Tests show wells contaminated 
■html?page=all 

For more stories, see items 3, 4 , and 21 
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Public Health and Healthcare Sector 



33. May 9, Bergen County Record - (National) Wayne firm, RAM Medical, fined for 
selling tainted surgical supplies. RAM Medical Inc., a Wayne, New Jersey-based 
distributor of medical products, was ordered May 8 to pay almost $173,000 in fines and 
restitution for selling counterfeit and contaminated surgical mesh used to repair hernias, 
according to a U.S. attorney. The company also was sentenced to 3 years of probation. 
RAM entered a guilty plea to charges of selling adulterated and misbranded mesh in 
December 2011, through its founder and owner. From 2008 through 2009, RAM 
bought about 520 boxes of surgical hernia mesh either directly or indirectly from a 
business called Medserve in India. RAM sold the mesh to seven customers. It admitted 
that boxes sold between December 2008 and June 2009 included mesh that was tainted 
with microorganisms. RAM further admitted that boxes distributed between October 
2008 and January 2010 contained counterfeit mesh that was falsely branded with the 
name of Davol Inc., a subsidiary of Murray Hill-based medical equipment maker C.R. 
Bard. 
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Source: 

http://www.northiersey.com/news/NJ firm sentenced for reselling contaminated me 
sh.html 



34. May 9, Milwaukee Journal Sentinel - (National) U.S. Senate panel launches 
investigation of painkillers, drug companies. The Milwaukee Journal Sentinel 
reported May 9 the U.S. Senate Committee on Finance opened a bipartisan 
investigation into financial relationships between companies that make narcotic 
painkillers and various non-profit organizations that have advocated their use for the 
treatment of pain. Citing investigative reports by the Milwaukee Journal Sentinel, 
MedPage Today, and others, the committee is seeking financial and marketing records 
from three companies that make opioid drugs, including Oxycontin and Vicodin, and 
seven national organizations. “It is clear that the United States is suffering from an 
epidemic of accidental deaths and addiction resulting from increased use of powerful 
narcotic painkillers,” said a joint statement from committee members. The Senators 
said there was growing evidence that drug companies have promoted misleading 
information about the safety and effectiveness of the drugs with help from nonprofits 
they have donated to. 

Source: http://www.isonline.com/watchdog/watchdogreports/us-senate-panel-launches- 
investigation-of-painkillers-drug-companies-4u5arrl-150767225.html 

35. May 8, Asbury Park Press - (New Jersey) 19-year-old girl charged in bomb threat at 
Berkeley nursing home. A former employee at Holiday Care Center in Berkeley, New 
Jersey, was arrested in connection with a bomb scare at the care center, the Asbury 
Park Press reported May 8. Township police said the arrest was made for the April 17 
incident where the female worker left a note in an employee bathroom stating the 
threat. That threat forced the evacuation of 162 patients and 70 employees at the center. 
She was charged with causing false public alarm and making terroristic threats. 

Source: http ://w w w . app .com/article/20 1 20508/NJNEW S/30508007 4/ 1 9- year-old- girl- 
charged-in-bomb-threat-at-Berkeley-nursing-home 

For another story, see item 40 
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Government Facilities Sector 



36. May 9, Reuters - (Florida) Florida nabs white supremacists planning ‘race 

war’. Ten alleged members of a white supremacist group training near Orlando for a 
“race war” were rounded up in a series of arrests in central Florida, authorities said 
May 8. The arrests were based on evidence from a confidential informant who 
infiltrated the neo-Nazi organization known as the American Front (AF) 17 months 
ago, according to an arrest affidavit. It said the group’s alleged local ringleader 
operated a heavily fortified paramilitary training center for the AF on his isolated 
property in St. Cloud, Florida. It said he recently plotted a disturbance at Orlando City 
Hall and a confrontation against a rival skinhead group in coastal Melbourne in a bid to 
garner media attention, but was also experimenting with the potential manufacture of 
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the biological toxin ricin. The investigation into the AF was conducted by the FBI’s 
Joint Terrorism Task Force and local law enforcement agencies. 

Source: http://www.reuters.com/article/2012/05/09/us-usa-florida-skinheads- 
idUSBRE84804Q20 120509 

37. May 8, Chicago Tribune - (Illinois) Material carried out that caused evacuation of 2 

IIT buildings. The Chicago Police Bomb and Arson Unit carried out a potential 
explosive chemical May 8 that caused officials to call a Level 2 HAZMAT and 
evacuate two buildings on the Il linois Institute of Technology (IIT) campus. Fire media 
information initially stated an acid spill was in a basement of a building. As a 
precaution, officials evacuated that building and another located nearby. In an IIT news 
release, the material was identified as a potential explosive chemical in the basement of 
the Engineering 1 building. The Life Science Building also was evacuated. The 
hazardous material was discovered during a routine inspection, according to the release. 
Source: http://articles.chicagotribune.com/2012-05-Q8/news/chi-firefighters- 
evacuating-2-buildings-on-iit-campus-for-acid-spill— 20120508 1 iit-buildings- 
evacuation-acid-spill 

38. May 8, KITV 4 Honolulu - (Hawaii) Maui County included in Hawaii disaster 
declaration. Maui County, Hawaii, was added to the Presidential Disaster Declaration 
to assist with damage from the severe storms, flooding, and landslides that occurred 
March 3 through March 11, according to State Civil Defense. This amendment to the 
Disaster Declaration allows for assistance for emergency work and repair or 
replacement of public facilities in Maui County that received flood damage. It also 
allows for a Hazard Mitigation Grant Program to assist all counties. Preliminary 
damage assessments identified approximately $3.2 million in damage to public 
infrastructure in Maui County. 

Source: http://www.kitv.com/news/hawaii/Maui-County-included-in-Hawaii-disaster- 
declaration/-/8 905354/12852356/-/1 3m4 lfy/-/ 

39. May 8, Associated Press - (South Carolina) 3 facing charges in threats to Eau Claire 
High School. Three people were charged in connection with a string of bomb threats at 
a high school in Columbia, South Carolina, a U.S. attorney said May 8. A man is 
charged with calling in a bomb threat at Eau Claire High School in November 2011. 
One juvenile is charged with calling in bomb threats and making fake explosives. 
Another is facing a charge of lying to police. School officials called authorities and 
cancelled classes twice after bomb threats and fake bombs were found at the school in 
the fall of 201 1 and earlier in 2012. 

Source: http://www.midlandsconnect.com/news/story.aspx?id=751357#.T6qSRFKtrOQ 

40. May 8, KOMO 4 Seattle - (Washington) Whooping cough forces emergency closure 
of Blanchet. After more than 150 students called in sick May 8, Bishop Blanchet High 
School in Seattle declared an emergency closure for at least May 9 and May 10 due to 
whooping cough. According to a May 8 letter sent to parents, the principal consulted 
with the Seattle/King County Health Department and the Catholic Schools Department 
before making the decision to close. The principal asked parents to report sick children 
even during the closure so the school can track the illness. Washington State is 
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currently experiencing a whooping cough epidemic, with more than 1,100 cases 
reported in 2012. 

Source: http://www.seattlepi.com/local/komo/article/Whooping-cough-forces- 
emergency-closure-of-3543712.php 

41. May 8, WFAA 8 Dallas - (Texas) Threatening letters found at six North Texas 
schools. Letters containing threats and a white powder were found at six north Texas 
schools in four cities May 8. A seventh letter was delivered to Lighthouse Baptist 
Church in Grand Prairie. The powder was determined to be a non-threatening 
substance. The suspicious letters were reported at the following schools: Pierce Early 
Childhood Development Center, Clifton Early Childhood Center, and West Irving 
Head Start in Irving; West Garland Head Start Center in Garland; Mesquite Head Start 
in Mesquite; and Head Start/Early Head Start in Dallas. At least one of the letters, 
delivered to Pierce Early Childhood Development Center in Irving, was reported to be 
accompanied by a threat from “al-Qaida.” All of the buildings were evacuated, and 
hazardous materials experts were called to handle the suspicious materials. Federal 
postal inspectors were called in to supervise the investigation. 

Source: http://www.wfaa.com/news/local/Threatening-letters-found-at-three-North- 
Texas-schools-150677375.html 



42. May 7, Times of Northwest Indiana - (Indiana) Suspected pipe bomb found near 
Schererville school. Federal officials now have what could be a pipe bomb after an 
elementary school student found it May 4 and carried it home, said police in 
Schererville, Indiana. The sealed plastic plumbing pipe was found near a fence on the 
west side of Watson Elementary School and Grimmer Middle School. An adult called 
police when he saw the boy carried the pipe back to his home. The 6-inch-long pipe 
contained a black powder and was sealed with duct tape. Bureau of Alcohol, Tobacco, 
Firearms and Explosives (ATF) officials took possession of the device for analysis, an 
ATF special agent said. The child told police a fuse was found with the device, but by 
the time ATF went to the home no fuse was connected. Schererville police are handling 
a follow-up investigation into how the pipe ended up near the school. 

Source: http://www.nwitimes.com/news/local/lake/schererville/suspected-pipe-bomb- 
found-near-schererville-school/article_lbb60c67-3a69-5 165-b941-32alalca9ff8.html 



For more stories, see items 14 , 19 , and 53 
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Emergency Services Sector 

43. May 8, Firehouse.com - (New Mexico) New Mexico Forestry unveils email alert 
system. New Mexico State Forestry Division officials unveiled a new e-mail alert 
system May 7 aimed at reaching a broad audience. A forestry spokesman told KUNM 
89.9 FM Albuquerque that the e-mails will contain information including when the fire 
started, the cause, and a description of threatened homes and communities. In its 
infancy, the system will send users information on fires from the entire state, but as it 
grows, it will be targeted at the area each user lives in. 
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Source: http://www.firehouse.com/news/1071 1289/new-mexico-forestry-unveils-email- 
alert-system 



44. May 8, Associated Press - (Arizona; Colorado) Sanctions sought in AZ chopper 
crash. The Federal Aviation Administration (FAA) is seeking sanctions against a 
Colorado company stemming from a 2010 medical-helicopter crash in Arizona that 
killed the aircraft’s three-member crew, the Associated Press reported May 8. An FAA 
spokesman said the agency wants to lodge a $50,625 fine against Colorado-based Air 
Methods, the parent company of LifeNet Arizona and the helicopter’s operator. The 
development comes on the heels of a report by the National Transportation Safety 
Board that said the July 28, 2010, crash likely was caused by a contract mechanic’s 
mistake and a lack of proper inspection and testing of his work. The helicopter left 
Marana, Arizona, and was en route to its home base in Douglas when it fell 600 feet, 
crashed into a backyard fence in Tucson, and burst into flames. 

Source: http://www.miamiherald.com/2012/05/Q8/2789763/apnewsbreak-sanctions- 
sought-in.html 
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Information Technology Sector 

45. May 9, Help Net Security - (International) Phishing impersonating email service 
providers spikes. Phishing attacks impersonating e-mail service providers increased 
333 percent from Q4 201 1 to Q1 2012. IT security firm Internet Identity (IID) attributes 
this spike to spammers needing unsullied e-mail addresses since many major spamming 
botnets have been shut down, and Internet service providers have become more 
successful at identifying and blocking e-mail from botnets and other known spam 
sources. During the first quarter of 2012, spammers increasingly tried to hijack “good” 
e-mail addresses at large Web mail services by impersonating those e-mail service 
providers and phishing for e-mail account log-in credentials. Despite the dramatic jump 
in e-mail service provider phishing, other industries on average witnessed a decrease in 
phishing attacks. IID found phishing attacks dropped 2 percent when comparing 
statistics from Q1 2011 to Q1 2012. 

Source: http://www.net-security.org/secworld.php ?id=12896&utm 

46. May 9, Help Net Security - (International) Java drive-by generator used in recent 
attack. A malware delivery campaign that doubles infection efforts to ensure users are 
compromised was recently spotted by F-Secure researchers. One discovered a Web site 
that poses as a “Gmail Attachment Viewer,” which attempts to make the visitor run the 
offered application. The pop-up warning from Windows identifies it as a “Microsoft” 
application, but says the app’s digital signature cannot be verified and that the app’s 
publisher is “Unknown.” If the user does choose to run the app, he/she is faced with a 
Cisco Foundation invitation to attend a conference, while the download and the quiet 
installation of a malicious binary is performed in the background. The message 
contains an embedded link that, if clicked, again tries to download the same malware. 
The researcher does not mention how she ended up on the site in question in the first 
place, and what type of malware is actually pushed onto the user, but points out that the 
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infection is generated using iJava Drive-by Generator. “The generator allows the 
attacker to use random names or specify their own preference for both the Java file and 
the dropped Windows binary,” the researcher explains, and notes the tool also indicates 
to the attackers how many infections the delivered malware effected. 

Source: http://www.net-securitv.org/malware news.php?id=2101&utm 

47. May 9, H Security - (International) Thousands of Twitter passwords allegedly 
exposed. About 55,000 Twitter account names and passwords, it was claimed May 8, 
were published on Pastebin May 7. Twitter confirmed it was investigating the situation 
and said it was resetting the passwords of affected accounts. Later examination of the 
list by Twitter revealed it contained 20,000 duplicates, suspended spam accounts, and 
incorrect log-in credentials. It is unclear where the data came from — Mashable said 
hackers affiliated with Anonymous were involved, but no apparent announcement from 
the hackers was made. It does not appear Twitter’s systems were compromised. A 
random sampling of a number of the accounts by a Hacker News reader found them to 
typically have several followers and to be following thousands of other Twitter users — 
a common footprint of a Twitter spam account. An analysis by an Eset blogger found 
that even after deduplicating the list, 25,000 entries in the remaining list were e-mail 
addresses. This leaves around 9,000 apparent Twitter spam accounts. Eset compared 
the accounts with previous leaks and found the e-mail ones apparently matched a June 
2011 LulzSec leak and also found some of the spam accounts posted in an April 2012 
forum post. 

Source: http://www.h-online.com/security/news/item/Thousands-of-Twitter-passwords- 
allegedly-exposed- 1571195 .html 

48. May 9, H Security - (International) Microsoft Patch Tuesday more extensive than 
anticipated. Microsoft released 7 bulletins to close 23 vulnerabilities on its May Patch 
Tuesday. The total number of bulletins belies the scope of the patches, however, as the 
combined update MS 12-034 closes holes in numerous products. The reason for this is a 
critical hole in the code for processing TrueType fonts exploited by the Duqu spyware 
in 2011. The hole was closed in the Windows kernel on the December Patch Tuesday; 
however, Microsoft has since used a code scanner to track the vulnerable code in many 
other components; among them is the gdiplus.dll library, which is used by various 
browsers to render Web fonts. Some of the vulnerable files contained further holes 
Microsoft also patched within the same bulletin — meaning this update fixes many 
other flaws as well as the original vulnerability. It closes holes in all currently 
supported versions of Windows (from XP SP3 onwards, including Server), Office, the 
.NET framework, and Silverlight. These “bonus” holes include three privilege 
escalation problems in the Windows kernel, including flaws in the code for processing 
keyboard layouts. Bulletin MS 12-029 closes a critical hole in the code for processing 
RTL documents. It affects Office 2003, 2007, as well as Office Compatibility Packs 
SP2 and 3. The vulnerability was also closed in Office for Mac 2008 and 2011. Bulletin 
MS 12-035 addresses two critical holes in the .NET framework. The remaining four 
bulletins fix holes that have the second highest threat rating by Microsoft, “important.” 
These vulnerabilities affect Office, Visio Viewer 2010, the Windows partition manager, 
and the Windows firewall and TCP stack. 
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Source: http://www.h-online.com/securitv/news/item/Microsoft-Patch-Tuesday-more- 
extensive-than-anticipated- 157107 8 .html 

49. May 9, H Security - (International) PHP team makes another attempt to close 
critical CGI hole. The PHP development team made another attempt to fix the critical 
vulnerability in the interaction with CGI. In CGI mode, PHP interprets certain URL 
parameters as command line parameters. This can cause affected servers to return the 
source code of a page if the ?-s character string is attached to the end of a URL. The 
details of the vulnerability were made public when developers accidentally marked the 
relevant entry in the bug tracking system as “public.” The vulnerability is being 
actively exploited for attacks. Originally, the problem was supposed to be fixed in 
versions 5.3.12 and 5.4.2, released the week of April 30. However, it was soon found 
the updates provided an incomplete solution and further ways of exploiting the hole 
appeared to exist. Security experts also say the rewrite rule initially published as a 
workaround could easily be bypassed. With the release of versions 5.3.13 and 5.4.3, the 
developers renewed their promise that the hole is fixed. A buffer overflow in the 
apache_request_headers function was also fixed in the 5.4 branch. A security expert 
said the vulnerability involves a stack buffer overflow that can only be exploited on 
systems that run PHP in CGI mode. Reportedly, the vulnerability can be exploited in 
combination with components such as the lighttpd Web server. 

Source: http://www.h-online.com/security/news/item/PHP-team-makes-another- 
attempt-to-close-critical-CGI-hole- 15709 1 6.html 

50. May 9, IDG News Service - (International) Police-themed ransomware targets U.S., 
Canadian users. A ransomware application that locks computers and asks their owners 
to pay fines for allegedly violating several laws through their online activity is targeting 
U.S. and Canadian users, malware experts from security firm Trend Micro said May 9. 
The Trend Micro researchers refer to this particular ransomware — malware that 
disables system functionality and asks for money to restore it — as the “Police Trojan,” 
because it displays rogue messages claiming to originate from law enforcement 
agencies. The “Police Trojan” appeared in 2011 and originally targeted users from 
several countries in Western Europe, including Germany, Spain, France, Austria, 
Belgium, Italy, and the United Kingdom. The rogue message displayed after locking 
down a victim’s computer is localized in the victim’s language and claims to be from a 
national law enforcement agency from the victim’s country. The owners of the locked- 
down computers are told their IP addresses were involved in illegal activities and are 
asked to pay a fine using prepaid cards like Ukash or Paysafecard. The malware’s 
authors prefer these payment services because transactions cannot be reversed and are 
hard to trace. When investigating new command and control servers recently used by 
this malware, Trend Micro researchers found message templates designed for U.S. and 
Canadian users. This suggests the malware’s scope was extended to these two 
countries. 

Source: 

http://www.computerworld.eom/s/article/9227015/Police themed ransomware targets 
U.S ._Canadian_users 
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51. May 8, CNET - (International) Plaxo shuts back door spammers used to access 
Google accounts. Contact list management application maker Plaxo told CNET May 8 
that it shut a back door spammers were using to stealthily access Google accounts. “A 
malicious party has obtained on their own, not through Plaxo, a set of Google account 
credentials,” said a general manager at Plaxo. “They’ve used our server, which is meant 
to allow customers to access their own Google accounts, to gain access to those 
accounts they already had. That made it difficult for Google to detect that 
(unauthorized) activity because they came through our IP address as a proxy.” Google 
has been fighting off an attack from this source for some time, the general manager 
said. 

Source: http://news.cnet.com/8301-1009 3-57430158-83/plaxo-shuts-back-door- 
spammers-used-to-access-google-accounts/ 

52. May 8, Threatpost - (International) Adobe patches 13 flaws in Photoshop, Flash 
Professional and other apps. Adobe released patches for a series of vulnerabilities in 
its product line, including Photoshop, Illustrator, Flash Professional, and Shockwave. 
Several of the vulnerabilities can be used to take complete control of affected 
machines. The highest-priority vulnerabilities among those patched May 8 is a group of 
five flaws in Shockwave that can be used to run malicious code on vulnerable 
machines. The update applies to both Windows and Mac machines and Adobe is 
recommending that users upgrade to version 1 1.6.5.635. The bug patched in Flash 
Professional May 8 is separate from the one that Adobe patched in Flash the week of 
April 30, which is currently being used in targeted attacks. 

Source: http://threatpost.com/en us/blogs/adobe-patches- 1 3-flaws-photoshop-flash- 
professional-and-other-apps-050812 

53. May 8, Dark Reading - (International) Targeted attack infiltrates at least 20 
companies. Beginning in mid-201 1, a widespread series of cyberattacks targeted a 
number of private firms, think thanks, and government organizations with links to 
policies of interest to China. While attributing attacks to a specific actor is difficult, the 
attackers used a common command-and-control server to manage the exploitation and 
control of computers within each victim’s network. In its research into the attacks — 
dubbed Project Enlightenment — security intelligence firm Cyber Squared managed to 
infiltrate the attackers’ communications channel and gather information on the attacks. 
The targets of the attacks were diverse: a mining corporation with interests in the 
automotive industry; Canadian judicial offices handling the extradition of a Chinese 
national; a major law firm with clients all over the globe; and an international maritime 
group with connections to the United Nations. 

Source: http://www.darkreading.com/advanced- 
threats/ 167901091 /securit y/vulnerabilities/23290 1 67 6/ 



For another story, see item 57 
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Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at sos@us-cert.gov or 
visit their Web site: http://www.us-cert. gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: https://www.it-isac.org 
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Communications Sector 



54. May 9, KITV 4 Honolulu - (Hawaii) Service cut to thousands of cell phone users. A 
cracked sewer line led to cell phone coverage being cut for thousands around the 
Hawaii islands. Work began May 8 to repair a cracked 6-inch sewer line in Aiea. But 
when city crews dug up the damaged pipe, they also cut a critical fiber-optic line 
underneath. The fiber-optic cable was used for a many businesses, from banks to cell 
phone companies. The line was connected to Hawaiian Telecom’s Aiea central office 
and allowed cell phone towers from many companies to connect to their networks. But 
after the cut, many could not get through. “For us, a large chunk of our north shore 
coverage and Mililani were impacted, along with partial impacts up the Waianae 
Coast,” the chief technical officer for Mobi PCS said. The connection troubles not only 
affected Oahu. Some on the Big Island, Maui, and Kauai were without service. 
Hawaiian Telecom said crews were able to reroute some connections after the break, 
but thousands still felt the effects of the cut cable. By the early evening May 8, 
Hawaiian Telecom crews were able to cut out the damaged part of the cable and began 
splicing in a new section. Customers were gradually connected, but the repair work 
continued throughout the night. 

Source: http://www.kitv.com/Cut-cable-quiets-cell-phones/-/8906042/12924432/- 
/12ilof9z/-/index.html 

55. May 8, LaSalle News Tribune - (Illinois) Phone service restored to Granville 
area. Residents of Granville, DePue, and McNabb, Illinois, experienced some 
disruption of telephone service May 8, but service has been restored, according to a 
Frontier Communications general manager. He said the outage was due to a power 
surge at the Granville office, which damaged some rectifiers. The surge occurred early 
May 8, he said, and the company had to first locate the source of the problem and then 
acquire replacement parts. The dial tone was restored in about 10 hours, he said. 
Communication between villages was limited, however, due to additional damage to 
fiber optics termination cards. The cards were diagnosed, identified and delivered to the 
site. The new cards were installed and tested around about 6 hours later. “Those inter- 
office links were then brought back up,” he said. 

Source: 

http://newstrib.com/main.asp?SectionID=2&SubSectionID=29&ArticleID=1921 1 

For another story, see item 45 



T Return to top ] 



-21 - 



Commercial Facilities Sector 



56. May 9, Phoenix Business Journal - (Arizona) Prescott fire destroys three downtown 
buildings. Three businesses on Prescott, Arizona’s historic Whiskey Row were 
damaged by a fire May 8. The Bird Cage Saloon and Pearl’s Place Cafe were 
completely destroyed, while Prescott Food Stores was 80 percent damaged, the Arizona 
Republic reported. Damage was expected to be in the millions of dollars. Investigators 
were still working to determine what caused the fire. KNXV 15 Phoenix reported that 
fire officials believe the fire began in the attic of one of the buildings. 

Source: http://www.biziournals.com/phoenix/moming call/20 12/05/prescott-fire- 
destroys-three-downtown.html 



57. May 8, Internet Crime Complaint Center - (International) Malware installed on 
travelers’ laptops through software updates on hotel Internet connections. Recent 
analysis from the FBI and other government agencies demonstrates that malicious 
actors are targeting travelers abroad through pop-up windows while establishing an 
Internet connection in their hotel rooms, the Internet Crime Complaint Center reported 
May 8. Recently, there have been instances of travelers’ laptops being infected with 
malicious software while using hotel Internet connections. In these instances, the 
traveler was attempting to setup the hotel room Internet connection and was presented 
with a pop-up window notifying the user to update a widely-used software product. If 
the user clicked to accept and install the update, malicious software was installed on the 
laptop. The pop-up window appeared to be offering a routine update to a legitimate 
software product for which updates are frequently available. The FBI recommended 
that all government, private industry, and academic personnel who travel abroad use 
extra caution before updating software while connected to hotel Internet connections. 
Source: http://www.ic3.gov/media/2012/120508.aspx 

58. May 7, Evansville Courier-Press - (Indiana) Kunkel Square building closed over fire 
safety issues. The Indiana Department of Homeland Security closed an Evansville, 
Indiana apartment building May 7 for improper alert equipment and having only one 
flight of stairs to its top attic floor, officials from the building’s owner, the Kunkel 
Group, said. The firm’s vice president said State inspectors required an audible fire 
alarm system with a voice that leads evacuees to stairwells. Inspectors also required 
that Kunkel install a second stairwell to an attic area. The company’s vice president 
said the closure would leave up to 15 tenants homeless, but Kunkel was working to find 
them alternative arrangements. 

Source: http://www.courierpress.com/news/2012/rnay/07/no-headline— 
ev kunkelsquare/ 

For more stories, see items 4, 53, and 54 
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See item 43 
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Dams Sector 



59. May 9, Your News Now Albany - (New York) Gilboa Dam testing sirens today. The 
sirens at Gilboa Dam in Schoharie County, New York, were tested May 9 for the first 
time since they were knocked offline during Tropical Storm Irene in August 2011. 
Officials said it cost more than $200,000 to get the 19 sirens back in working order. 

The sirens were not designed for a high water event, but rather impending failure of the 
dam. Officials are reconsidering changing the plans after the alarms saved lives during 
Irene. 

Source: http://hudsonvallev.vnn.com/content/top stories/583554/gilboa-dam-testing- 
sirens-today/ 



60. May 9, KBOI 2 Boise - (Idaho) Star mayor declares state of emergency due to 

flooding. The mayor of Star, Idaho, declared a state of emergency May 8 in response to 
two levee breaches along the Boise River. The water flooded over some canals into 
some nearby fields and ditches in the area. The declaration allows the city to be eligible 
for more funding and aid, but the mayor said flood crews in Ada County repaired the 
breaches without additional help. Some flooding remained in the fields and ditches but 
no buildings were damaged as of May 9. The Boise River was flowing at 8,000 cubic 
feet per second (cfs) and expected to remain at that level as the U.S. Army Corps of 
Engineers continues to release water from the upstream reservoirs. Flood stage is 
considered 7,000 cfs. 

Source: http://www.kboi2.com/news/local/Star-mayor-declares-state-of-emergencv- 
due-to-flooding- 150711 245 .html 
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Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 



About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for ten days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailyReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703)387-23 14 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support@govdelivery.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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